fix(track-a): retain lease lock after normal launcher exit

[blakinio]

Post-merge remediation for OTC-20260815-track-a-live-runtime-lease-manager, based on main@f6fa2264904c6ffb3734d4a63e1edbb29260fcc1.

Material finding

Final review on PR #311 reproduced a remaining P1 serialization defect: guard-run -- bash -c 'sleep 8 &' allowed the immediate launcher to return normally, after which LeaseManager.locked() explicitly issued LOCK_UN. Because Linux flock is associated with the shared open file description, that explicit unlock released the lock even though the background mutation child still held an inherited descriptor.

Fix

• remove explicit LOCK_UN from the production lock context and close only the manager's descriptor copy;
• ordinary operations release through last-close semantics;
• guard-run retains the flock until the last surviving inherited mutation descendant closes its descriptor, including normal immediate-launcher return;
• deterministic regression proves a second nonblocking flock is denied while the background child survives and becomes available after child exit;
• MODULE_CATALOG.md and CHANGELOG.md document the changed public guard-run contract.

Validation

Semantic run 31910656040 on code/test head c11921267a1f7306d61046c4922b30d35c258703:

• unit job 95075082947 SUCCESS, 14/14 tests including test_guard_normal_launcher_exit_keeps_lock_in_background_child;
• isolated Synology job 95075082997 SUCCESS with CONCURRENT_SERIALIZATION_PROVEN, SELFTEST_COMPLETE, and CANONICAL_STATE_UNTOUCHED.

Final exact-head repository CI 31911020207 on 250e347b7177e737bd8be56eda785b827b605efc: CI / Required SUCCESS. Final review has zero unresolved material threads.

Final changed paths are limited to the manager implementation, deterministic tests, durable task record, module catalogue and changelog. The temporary branch-only semantic trigger is absent from the final diff.

Safety

No Tibia process/session/display/input/instrumentation or production canonical-live state is mutated. PR #303 runtime paths/processes and Track B remain untouched. :98 remains NOT_PROVEN/NOT_REGISTERED as canonical. No owner-funded Codex/OpenAI API or paid AI quota was used.

[blakinio]

Coordinator merge-order note: this is the foundational remediation for the currently active supervisor PR #316. Because both branches touch the same canonical-live lease task/paths, do not merge concurrently. Complete #317 semantic + exact-head CI first; if independently accepted, promote #317 to main, then require #316 to restack on the resulting main and rerun its supervisor regressions. This ordering prevents #316 from relying on a flock open-file-description that its parent still explicitly unlocks on normal launcher return.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d765f2d73b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[blakinio]

Final audit note: current head d765f2d73b728cfa62b5ddf1865b29080146e84c has semantic run 31910656040 with unit 95075082947 SUCCESS and Synology 95075082997 SUCCESS; final repository CI 31910767831 including CI / Required 95075562741 is SUCCESS. Source review found the last-close change appropriately minimal and its regression directly exercises normal launcher return with a surviving background child. Once the task record releases ownership (ready/unassigned), coordinator promotion may proceed. Merge order remains #317 first, then #316 restacked/revalidated on the resulting main.